The problem

Third-party email content needed to remain useful and interactive without leaking malicious code, styles or scripts into the host CRM.

Constraints

• Untrusted HTML email content
• Support for images, PDFs, video and audio attachments
• Compatibility with external email synchronisation

How I approached it

Built sandboxed email previews, condensed and expanded message views, in-place attachment previews and reply flows synchronised through IMAP and SMTP.

My contribution

Owned frontend delivery and contributed across the supporting Node.js and NestJS services.

Outcomes

• Resolved critical XSS and CSS-leak risks; the October 2024 résumé reports a security-risk reduction above 90%.
• Reduced support tickets related to email navigation by 50%.

What I learned

• Rendering untrusted content safely requires isolation boundaries that protect both the host interface and the user workflow.

Technology

Vue 3 · Pinia · TanStack Query · Node.js · NestJS · Cypress · IMAP · SMTP